Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.206.0 to 3.207.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.207.0</h2>
<h2>3.207.0 (2025-11-12)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Log gRPC requests before invoking them in gRPC debug
interceptor
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20817">#20817</a></p>
</li>
<li>
<p>[engine] Add <code>ReplaceWith</code> resource option to allow one
resource's replace operations to trigger another's
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20693">#20693</a></p>
</li>
<li>
<p>[sdkgen/python] Allow all PEP440 version specifiers to be used</p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/import] Return errors when an import fails
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20904">#20904</a></p>
</li>
<li>
<p>[engine] Fix parenting of resources in some cases in <code>refresh
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20894">#20894</a></p>
</li>
<li>
<p>[engine] Fix StackReference secrets performance
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20908">#20908</a></p>
</li>
<li>
<p>[programgen] Do not panic when re-writing type-invalid PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20770">#20770</a></p>
</li>
<li>
<p>[sdk/go] Fix import path in instructions when linking a package in Go
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20888">#20888</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix closure serialization on Node.js v25.2.0
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20913">#20913</a></p>
</li>
<li>
<p>[sdk/{nodejs,python}] Avoid cancellations due to do slow processing
of requests</p>
</li>
<li>
<p>[sdk/python] Avoid cancellations due to do slow processing of
requests in the callbacks server
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20917">#20917</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[engine] Stop sending ConfigPropertyMap as part of RunRequest
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20887">#20887</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.207.0 (2025-11-12)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Log gRPC requests before invoking them in gRPC debug
interceptor
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20817">#20817</a></p>
</li>
<li>
<p>[engine] Add <code>ReplaceWith</code> resource option to allow one
resource's replace operations to trigger another's
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20693">#20693</a></p>
</li>
<li>
<p>[sdkgen/python] Allow all PEP440 version specifiers to be used</p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/import] Return errors when an import fails
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20904">#20904</a></p>
</li>
<li>
<p>[engine] Fix parenting of resources in some cases in <code>refresh
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20894">#20894</a></p>
</li>
<li>
<p>[engine] Fix StackReference secrets performance
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20908">#20908</a></p>
</li>
<li>
<p>[programgen] Do not panic when re-writing type-invalid PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20770">#20770</a></p>
</li>
<li>
<p>[sdk/go] Fix import path in instructions when linking a package in Go
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20888">#20888</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix closure serialization on Node.js v25.2.0
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20913">#20913</a></p>
</li>
<li>
<p>[sdk/{nodejs,python}] Avoid cancellations due to do slow processing
of requests</p>
</li>
<li>
<p>[sdk/python] Avoid cancellations due to do slow processing of
requests in the callbacks server
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20917">#20917</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[engine] Stop sending ConfigPropertyMap as part of RunRequest
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20887">#20887</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5e3a50056a"><code>5e3a500</code></a>
upgrade language providers to latest versions (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20918">#20918</a>)</li>
<li><a
href="ff9df44da3"><code>ff9df44</code></a>
Avoid cancellations due to do slow processing of requests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20920">#20920</a>)</li>
<li><a
href="a332525939"><code>a332525</code></a>
schema: allow any pep440 constraint for specifying pulumi version in
python (...</li>
<li><a
href="ff1b5f6ddb"><code>ff1b5f6</code></a>
Disambiguate registry and non-registry templates in <code>pulumi
new</code> select (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20701">#20701</a>)</li>
<li><a
href="5137a3fc9f"><code>5137a3f</code></a>
import: actually return errors if we have them (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20904">#20904</a>)</li>
<li><a
href="b4002be0fe"><code>b4002be</code></a>
Avoid cancellations due to do slow processing of requests in the
callbacks se...</li>
<li><a
href="9c779ed24f"><code>9c779ed</code></a>
Fix StackReference secrets performance (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20908">#20908</a>)</li>
<li><a
href="4fedb1c1de"><code>4fedb1c</code></a>
Fix closure serialization on Node.js v25.2.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20913">#20913</a>)</li>
<li><a
href="32235a17d2"><code>32235a1</code></a>
Add <code>ReplaceWith</code> resource option (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20693">#20693</a>)</li>
<li><a
href="4201af6122"><code>4201af6</code></a>
Log deleteProvider calls (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20906">#20906</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.206.0...v3.207.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes)
from 4.23.0 to 4.24.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/releases">github.com/pulumi/pulumi-kubernetes/sdk/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.24.0</h2>
<h3>Added</h3>
<ul>
<li>Added a <code>plainHttp</code> option to the <code>v4.Chart</code>
resource. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3250">pulumi/pulumi-kubernetes#3250</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>The <code>pulumi.com/waitFor</code> annotation now uses an
<a
href="https://www.rfc-editor.org/rfc/rfc9535.html">RFC9535</a>-compliant
JSONPath
parser. This makes it possible to wait for more complex scenarios.</p>
<p>For example:</p>
<ul>
<li>
<p>To wait for a Pod's <code>status.phase</code> to be
"Running" or "Succeeded":</p>
<p><code>pulumi.com/waitFor: "jsonpath={.status[?@ == 'Running' ||
@ == 'Succeeded' ]}"</code></p>
</li>
<li>
<p>To wait for for an object to have a "Failed" <em>or</em>
"Complete" condition with
a "True" value:</p>
<p><code>pulumi.com/waitFor:
"jsonpath={.conditions[?(@.type=='Failed'||@.type=='Complete')].status}=True</code></p>
</li>
</ul>
<p>(Tools like <a href="https://jsonpath.com">jsonpath.com</a> are very
helpful for
ensuring your JSONPath expression works as expected.)</p>
<p>Importantly, please note that <code>kubectl wait
--for=jsonpath=...</code> supports only
a <em>subset</em> of RFC9535. This means some complex
<code>waitFor</code> annotations will not
be reproducible with <code>kubectl</code>.</p>
<p>Existing expressions should continue to work normally with one
notable
exception: a selector like <code>.items[]</code> now requires an
explicit wildcard, i.e.
<code>.items[*]</code>.</p>
<p>As a reminder, the <code>pulumi.com/waitFor</code> annotation is
experimental and
subject to change. Similarly, RFC9535 is still only <em>proposed</em>
and may also
change in the future.</p>
</li>
<li>
<p><code>enableConfigMapMutable</code> and
<code>enableSecretMutable</code> are now stable.
(<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/3886">pulumi/pulumi-kubernetes#3886</a>)</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>
<p>Helm resources all now use the correct
<code>registry/config.json</code> file for
credentials. For backward-compatibility <code>registry.json</code> is
preferred if
it exists. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3606">pulumi/pulumi-kubernetes#3606</a>)</p>
</li>
<li>
<p>Fixed an issue where deletions could take longer than necessary. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3317">pulumi/pulumi-kubernetes#3317</a>)</p>
</li>
<li>
<p>Significantly reduced memory usage. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3713">pulumi/pulumi-kubernetes#3713</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md">github.com/pulumi/pulumi-kubernetes/sdk/v4's
changelog</a>.</em></p>
<blockquote>
<!-- raw HTML omitted -->
<h1>CHANGELOG</h1>
<h2>Unreleased</h2>
<h3>Added</h3>
<ul>
<li>Added a <code>plainHttp</code> option to the <code>v4.Chart</code>
resource. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3250">pulumi/pulumi-kubernetes#3250</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>The <code>pulumi.com/waitFor</code> annotation now uses an
<a
href="https://www.rfc-editor.org/rfc/rfc9535.html">RFC9535</a>-compliant
JSONPath
parser. This makes it possible to wait for more complex scenarios.</p>
<p>For example:</p>
<ul>
<li>
<p>To wait for a Pod's <code>status.phase</code> to be
"Running" or "Succeeded":</p>
<p><code>pulumi.com/waitFor: "jsonpath={.status[?@ == 'Running' ||
@ == 'Succeeded' ]}"</code></p>
</li>
<li>
<p>To wait for for an object to have a "Failed" <em>or</em>
"Complete" condition with
a "True" value:</p>
<p><code>pulumi.com/waitFor:
"jsonpath={.conditions[?(@.type=='Failed'||@.type=='Complete')].status}=True</code></p>
</li>
</ul>
<p>(Tools like <a href="https://jsonpath.com">jsonpath.com</a> are very
helpful for
ensuring your JSONPath expression works as expected.)</p>
<p>Importantly, please note that <code>kubectl wait
--for=jsonpath=...</code> supports only
a <em>subset</em> of RFC9535. This means some complex
<code>waitFor</code> annotations will not
be reproducible with <code>kubectl</code>.</p>
<p>Existing expressions should continue to work normally with one
notable
exception: a selector like <code>.items[]</code> now requires an
explicit wildcard, i.e.
<code>.items[*]</code>.</p>
<p>As a reminder, the <code>pulumi.com/waitFor</code> annotation is
experimental and
subject to change. Similarly, RFC9535 is still only <em>proposed</em>
and may also
change in the future.</p>
</li>
<li>
<p><code>enableConfigMapMutable</code> and
<code>enableSecretMutable</code> are now stable.
(<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/3886">pulumi/pulumi-kubernetes#3886</a>)</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Helm resources all now use the correct
<code>registry/config.json</code> file for
credentials. For backward-compatibility <code>registry.json</code> is
preferred if
it exists. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3606">pulumi/pulumi-kubernetes#3606</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d439b2074c"><code>d439b20</code></a>
Update TestHelmRelease's metrics image and update test assertion (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3930">#3930</a>)</li>
<li><a
href="ffd70d544c"><code>ffd70d5</code></a>
Mark SecretPatch inputs as secrets (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3893">#3893</a>)</li>
<li><a
href="65219f0e61"><code>65219f0</code></a>
Update dependency <code>@pulumi/pulumi</code> to v3.206.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3925">#3925</a>)</li>
<li><a
href="f1a455ad5f"><code>f1a455a</code></a>
Fix dotnet flakes (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3924">#3924</a>)</li>
<li><a
href="12a40978d9"><code>12a4097</code></a>
Update dependency <code>@pulumi/gcp</code> to v9.4.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3910">#3910</a>)</li>
<li><a
href="cafe468258"><code>cafe468</code></a>
Remove the 'BETA FEATURE' status in front of
<code>enableConfigMapMutable</code> and `en...</li>
<li><a
href="967bd478ab"><code>967bd47</code></a>
Update a redis image (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3917">#3917</a>)</li>
<li><a
href="f52a5b29fd"><code>f52a5b2</code></a>
Automated upgrade: bump pulumi/pulumi to 3.205.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3912">#3912</a>)</li>
<li><a
href="402da8a915"><code>402da8a</code></a>
Update dependency <code>@pulumi/pulumi</code> to v3.205.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3909">#3909</a>)</li>
<li><a
href="a2bb6d7a53"><code>a2bb6d7</code></a>
Fix test cluster p-k version (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3902">#3902</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi-kubernetes/compare/v4.23.0...v4.24.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.205.0 to 3.206.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.206.0</h2>
<h2>3.206.0 (2025-11-05)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[protobuf] Pass a <code>preview</code> flag to invokes so they can
tell if they're being called during a preview
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20827">#20827</a></p>
</li>
<li>
<p>[cli/about] Include PULUMI_* environment variables in the
<code>pulumi about</code> output
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20855">#20855</a></p>
</li>
<li>
<p>[auto/go] Get event log over gRPC instead of trying to read it from a
text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20822">#20822</a></p>
</li>
<li>
<p>[auto/nodejs] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20824">#20824</a></p>
</li>
<li>
<p>[auto/python] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20833">#20833</a></p>
</li>
<li>
<p>[cli/engine] Add environment variable to add --refresh to
preview,update,destroy
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20797">#20797</a></p>
</li>
<li>
<p>[sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment
variable to skip the new feature of sending component inputs to the
engine for diffing and state storage
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20842">#20842</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix duplicate resource snapshot integrity issue, when
running <code>pulumi up --refresh --run-program</code> and when a
resource <code>PendingReplacement</code> exists in the snapshot
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20812">#20812</a></p>
</li>
<li>
<p>[engine] Support floating point NaN and Inf values in resource state
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20843">#20843</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/go] Use Language.Link to link Go packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20811">#20811</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.206.0 (2025-11-05)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[protobuf] Pass a <code>preview</code> flag to invokes so they can
tell if they're being called during a preview
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20827">#20827</a></p>
</li>
<li>
<p>[cli/about] Include PULUMI_* environment variables in the
<code>pulumi about</code> output
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20855">#20855</a></p>
</li>
<li>
<p>[auto/go] Get event log over gRPC instead of trying to read it from a
text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20822">#20822</a></p>
</li>
<li>
<p>[auto/nodejs] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20824">#20824</a></p>
</li>
<li>
<p>[auto/python] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20833">#20833</a></p>
</li>
<li>
<p>[cli/engine] Add environment variable to add --refresh to
preview,update,destroy
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20797">#20797</a></p>
</li>
<li>
<p>[sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment
variable to skip the new feature of sending component inputs to the
engine for diffing and state storage
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20842">#20842</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix duplicate resource snapshot integrity issue, when
running <code>pulumi up --refresh --run-program</code> and when a
resource <code>PendingReplacement</code> exists in the snapshot
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20812">#20812</a></p>
</li>
<li>
<p>[engine] Support floating point NaN and Inf values in resource state
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20843">#20843</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/go] Use Language.Link to link Go packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20811">#20811</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="72334612d3"><code>7233461</code></a>
revert "temporarily disable journal validation" (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20875">#20875</a>)</li>
<li><a
href="fad720c136"><code>fad720c</code></a>
Bump SDKs for v3.206.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20881">#20881</a>)</li>
<li><a
href="df81881bab"><code>df81881</code></a>
use event log in python (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20833">#20833</a>)</li>
<li><a
href="93d1e02d55"><code>93d1e02</code></a>
mark tests using dep_tracker as asyncio (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20876">#20876</a>)</li>
<li><a
href="8651da14aa"><code>8651da1</code></a>
refreshv2: only rebuild base state if we have a refresh (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20861">#20861</a>)</li>
<li><a
href="79a8a7d151"><code>79a8a7d</code></a>
fix operator precedence for persisted refreshes in journal (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20807">#20807</a>)</li>
<li><a
href="5ff9d4cc1b"><code>5ff9d4c</code></a>
skip another flaky tail test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20872">#20872</a>)</li>
<li><a
href="b71a38546d"><code>b71a385</code></a>
return a new state from a refresh step when resource is pending
replacement (...</li>
<li><a
href="e7dda0378e"><code>e7dda03</code></a>
feat: adding PULUMI_OPTION_REFRESH environment variable (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20797">#20797</a>)</li>
<li><a
href="4cba7a03a7"><code>4cba7a0</code></a>
Use Language.Link to link Go packages (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20811">#20811</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.205.0...v3.206.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This needs to be merged after we merge
https://github.com/modelcontextprotocol/registry/pull/726 and we cut a
release for v1.3.7
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.175.0 to 3.204.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.204.0</h2>
<h2>3.204.0 (2025-10-23)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20762">#20762</a></p>
</li>
<li>
<p>[engine] Support overriding policy severity on violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20767">#20767</a></p>
</li>
<li>
<p>[backend/service] Send journal entries to the backend if it's
supported
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20343">#20343</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using <code>destroy
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20692">#20692</a></p>
</li>
<li>
<p>[engine] Fix import error to contain the import ID of non-existent
resources
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20753">#20753</a></p>
</li>
<li>
<p>[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20774">#20774</a></p>
</li>
<li>
<p>[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20769">#20769</a></p>
</li>
<li>
<p>[sdkgen/go] Fix codegen of scalar return SDK functions
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20754">#20754</a></p>
</li>
<li>
<p>[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20747">#20747</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Use Language.Link to link Node.js packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20715">#20715</a></li>
</ul>
<h2>v3.203.0</h2>
<h2>3.203.0 (2025-10-15)</h2>
<h3>Features</h3>
<ul>
<li>[cli/display] Display policy severity for violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20746">#20746</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.204.0 (2025-10-23)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20762">#20762</a></p>
</li>
<li>
<p>[engine] Support overriding policy severity on violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20767">#20767</a></p>
</li>
<li>
<p>[backend/service] Send journal entries to the backend if it's
supported
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20343">#20343</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using <code>destroy
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20692">#20692</a></p>
</li>
<li>
<p>[engine] Fix import error to contain the import ID of non-existent
resources
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20753">#20753</a></p>
</li>
<li>
<p>[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20774">#20774</a></p>
</li>
<li>
<p>[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20769">#20769</a></p>
</li>
<li>
<p>[sdkgen/go] Fix codegen of scalar return SDK functions
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20754">#20754</a></p>
</li>
<li>
<p>[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20747">#20747</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Use Language.Link to link Node.js packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20715">#20715</a></li>
</ul>
<h2>3.203.0 (2025-10-15)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/display] Display policy severity for violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20746">#20746</a></p>
</li>
<li>
<p>[cli/package] Show functions in <code>package info</code></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="24654399ab"><code>2465439</code></a>
Bump dotnet language plugin to latest version (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20778">#20778</a>)</li>
<li><a
href="3882b627ba"><code>3882b62</code></a>
implement journaling API and send journal entries to the service
directly (<a
href="https://redirect.github.com/pulumi/pulumi/issues/2">#2</a>...</li>
<li><a
href="ef3c2a316b"><code>ef3c2a3</code></a>
[Node.js] Pass secret values as Output objects to resource hooks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20774">#20774</a>)</li>
<li><a
href="86503934b9"><code>8650393</code></a>
Support overriding policy severity on violations (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20767">#20767</a>)</li>
<li><a
href="be6db2b82a"><code>be6db2b</code></a>
Run analyzer lifecycle tests through gRPC (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20766">#20766</a>)</li>
<li><a
href="fd8c0a88b5"><code>fd8c0a8</code></a>
Pass secret values as Outputs to hooks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20769">#20769</a>)</li>
<li><a
href="d292447a49"><code>d292447</code></a>
Add some tests for Python type inspection utilities (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20736">#20736</a>)</li>
<li><a
href="ba809f361c"><code>ba809f3</code></a>
Add a <code>--version</code> flag to <code>pulumi-language-nodejs</code>
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/20768">#20768</a>)</li>
<li><a
href="89ea89b4da"><code>89ea89b</code></a>
update journaling docs (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20763">#20763</a>)</li>
<li><a
href="22797a9b84"><code>22797a9</code></a>
Share CurrentProjectContradictsWorkspace between backends (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20759">#20759</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.175.0...v3.204.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
There was feedback that other projects wanting to use the registry
package have to upgrade to 1.25 (because of how Go works). In the
registry itself we are not relying on 1.25 features so this PR reverts
us back to 1.24 until 1.25 becomes better adopted and we can safely move
to it.
Also realised we were not keeping our dependencies for our deploy/infra
code up to date with Dependabot so this fixes that too.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Telemetry to cover failure modes which are not covered by container logs
and metrics for finding resource constraints.
## Motivation and Context
When there is any issue with registry container we should be notified.
## How Has This Been Tested?
- Local seup
## Breaking Changes
- No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- No additional exporter is used, taken advantage of opentelemetry
collector
- It covers metrics related to resource constraints, currently only
limited to default namespace.
- Takes cares of kubernetes events as logs which are the source of
figuring out any problem with service, covers all such scenarios where
pod is not able to start yet and get missed because there are no
container logs for such cases. Limited to default namespace.
- Taken care of daemonset deployment i.e. deploying otel collector as
agent by using correct filtering.
- Cardinality contributing factors are only pod ids (but have to observe
more), node ids will not increase cardinality as scale up will lead to
limited nodes.
- Shipping of metrics for resources happens every 60s and list of
metrics that will be emitted
[https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/receiver/kubeletstatsreceiver/metadata.yaml](url)
- Container errors
<img width="1440" height="816" alt="Screenshot 2025-10-10 at 1 21 14 AM"
src="https://github.com/user-attachments/assets/ba90a217-2a49-4522-aa44-a98c02adf95b"
/>
- Resource metrics
<img width="1440" height="816" alt="Screenshot 2025-10-10 at 1 23 51 AM"
src="https://github.com/user-attachments/assets/3467be96-db3c-4930-afa2-3cbf5f0ced8b"
/>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Promotes prod to 1.3.3, the main changes are making mcpb package version
optional and also fixing the enforced schema validation.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Bumps prod to 1.3.2
Note
https://github.com/modelcontextprotocol/registry/actions/runs/18570490434
needs to complete before merging
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR fixes the docs and the image reference for prod since
they don't expect to have the v prefix there.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR bumps prod to v1.3.0
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR splits the workflows for deploying to prod and staging
easing the use of gitops flows for promotions.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR moves away from automatically promoting latest releases
to production in favour of specifying the released version explicitly
via a PR & Review process.
Still sets the image tag to latest for now so we can enable it
separately whenever we decide 👍
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
- Applied `gofmt -s -w` across the entire codebase to ensure consistent
Go formatting
- This will trigger a deployment with minimal code changes
## Test plan
- [x] Pre-commit hooks pass
- [x] No functional changes, formatting only
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
- Add workflow_dispatch to deploy.yml for manual deployment triggers
- Document that releases don't auto-deploy to production
- Add instructions for deploying releases to production
- Add verification steps for deployment
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR updates production to automatically receive new stable
releases when GitHub releases are cut while staging will continue
testing the latest main branch builds
Deails:
- Configures production deployment to **use latest stable** releases
instead of main branch
-`ghcr.io/modelcontextprotocol/registry:latest`(stable releases).
Released CLI matches version of the prod service API.
- Staging continues to **use main branch** for testing latest
development code - `ghcr.io/modelcontextprotocol/registry:main` (latest
development). Building the CLI from main would match the version of the
staging service API.
- Added environment-based Docker image tag selection logic
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
No
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
Bumps the node machine type from e2-small to e2-standard-2 to provide
more CPU and memory headroom for the cluster.
Also disables PodDisruptionBudgets (PDBs) for single-instance PostgreSQL
clusters to prevent node upgrade operations from becoming blocked.
## Changes
- Increase GKE node machine type from e2-small to e2-standard-2
- Set `enablePDB: false` for registry and Grafana PostgreSQL clusters
## Context
The machine type increase addresses resource constraints causing
deployment failures.
The PDB change prevents a specific issue where GKE node upgrades get
stuck when trying to drain nodes containing single-instance PostgreSQL
pods. With `minAvailable: 1` PDBs, evicting the only database instance
violates the availability requirement, blocking the drain operation
indefinitely. Disabling PDBs for these development/staging
single-instance databases allows node maintenance to proceed smoothly.
For production deployments requiring high availability, the instances
count should be increased to 3 with PDBs enabled.
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Motivation and Context
Logs will help in fixing issues quickly, thereby reducing the downtime
and MTTD.
## How Has This Been Tested?
End to end local setup is tested
## Breaking Changes
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- It handles container logs for mcp-registry pods.
- It supports k8sattributes resources which helps in identifying from
where the logs are coming.
- Supports victorialogs and it's plugin in grafana.
<img width="1129" height="383" alt="Screenshot 2025-09-15 at 1 43 51 AM"
src="https://github.com/user-attachments/assets/a560c541-721d-415c-a0a8-8cbe008c3af6"
/>
<img width="1134" height="703" alt="Screenshot 2025-09-15 at 1 44 34 AM"
src="https://github.com/user-attachments/assets/8b5b4132-9fc3-4b8e-8027-27c7787070f1"
/>
<img width="1134" height="727" alt="Screenshot 2025-09-15 at 1 46 10 AM"
src="https://github.com/user-attachments/assets/bcdb4d9d-cea1-4d88-8dd5-fa4cdb51031f"
/>
---------
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR addresses the feedback comments from #366
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
- Removed Azure deployment section and references from README
- Updated project structure to reflect current GCP prod/staging configs
- Removed Azure Load Balancer annotation from ingress controller
- Updated provider documentation to show GCP and local options only
- Added monitoring.go to project structure documentation
This cleans up outdated Azure/AKS deployment configuration that is no
longer used, leaving only the current GCP-based deployment structure.
## Motivation and Context
Ensures that the redirect url is set properly when logging in with
Google
## How Has This Been Tested?
In staging
## Breaking Changes
None
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Motivation and Context
Consistency with https://staging.registry.modelcontextprotocol.io/ URL
format (i.e. `<env>.<service>`, rather than `<service>.<env>`
## How Has This Been Tested?
Deployed in staging
## Breaking Changes
Grafana URL changes, but it's only just launched so fine.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Motivation and Context
After #328, the monitoring stack was failing to deploy because we hit
resource limits. This PR reduces the resource requests to a level
compatible with the cluster.
## How Has This Been Tested?
I've checked that everything still deploys happily in staging.
## Breaking Changes
None
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
This includes infra setup for metrics collection and visualisation
## Motivation and Context
It is important to have basic observability setup, so that common issues
can be identified quickly
## How Has This Been Tested?
- Tested on local
- Tested on one of the production setup
## Breaking Changes
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [X] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [X] My code follows the repository's style guidelines
- [X] New and existing tests pass locally
- [X] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- This includes set up of following components:
- Victoriametrics single node cluster for storing metrics data with
persistent storage configuration for local and production env.
- Vmagent with target discovery for mcp-registry pods with scrape
interval of 30s.
- Grafana for visualising metrics and setting alerts.
- Datasource of victoriametrics is pre-configured as config map
- Persistent volume for basic configuration
- Sqlite for local and Postgres for production setup for storing
dashboard, alerts etc details
## Metrics in action
<img width="1422" height="666" alt="Screenshot 2025-08-31 at 4 35 28 AM"
src="https://github.com/user-attachments/assets/e54ce846-653c-4fa3-aa7a-fe277f0810e6"
/>
---------
Co-authored-by: Adam Jones <adamj@anthropic.com>
Co-authored-by: adam jones <adamj+git@anthropic.com>
## Summary
This PR implements OIDC authentication support for admin users,
specifically configured for Google Cloud Identity. The implementation
includes:
- Configurable OIDC authentication endpoints and validation
- Google Cloud Identity integration for admin access
- JWT token validation and user session management
- Deployment configuration updates for OIDC provider settings
Fixes#283
<!-- Provide a brief summary of your changes -->
Implements automated database backup functionality with Google Cloud
Storage integration, including retention policies and MinIO support for
local development.
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This change adds critical database backup capabilities to ensure data
durability and disaster recovery. The solution provides automated
backups with configurable retention policies and supports both
production (GCS) and development (MinIO) environments.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- Tested backup creation and restoration with MinIO in local development
- Verified GCS bucket lifecycle policies for automatic deletion after 60
days
- Tested backup retention and cleanup logic
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No breaking changes. This is an additive feature that doesn't affect
existing functionality.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
- Implements 60-day retention period for backups as a safety net
- Uses GCS lifecycle rules for automatic cleanup
- Includes MinIO setup instructions for local development testing
- Port-forwarding commands updated for consistency across documentation
- Fixes#184
Fixes#228
## Motivation and Context
See #19
## How Has This Been Tested?
- Run locally
- Run in docker compose
- Run infra in minikube
- Unit and integration tests all passing :)
## Breaking Changes
Yes: users will not be able to access any data they used to have in
custom mongodb. We are accepting this breaking change, given the
registry is in experimental development status.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
I have not implemented connection pooling support for simplicity, and
because cloudnative-pg already provides built-in connection pooling with
pgBouncer so if we want it later we can switch to this endpoint easily.
## Motivation and Context
- Adds credentials for the new MCP Registry Login GitHub Apps (local,
staging, prod)
- Adds support for "none" auth to publisher
## How Has This Been Tested?
- Tested publisher workflows locally
- Unit and integration tests passing
## Breaking Changes
None
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
---
Merging based on Tadas's approval review, and only making minor docs changes on top of that.
## Motivation and Context
In staging (and prod, for now) we pull the `:latest` mcp-registry image.
But K8s won't actually change anything unless we recreate the pods.
This change ensures the workflow goes from docker -> staging -> prod,
and changes the annotation so that the pods are recreated each deploy.
This ensures they actually pull the latest version.
## How Has This Been Tested?
Deployed locally to minikube
## Breaking Changes
None
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Fixes#264. Adds endpoints:
```
/v0/auth/github # exchange a github token for a registry token that gives you access to namespaces io.github.username and io.github.org for your orgs
/v0/auth/none # get a registry token for namespace io.modelcontextprotocol.anonymous (only for testing/local dev purposes)
```
Updates `/v0/publish` to accept one of these registry tokens.
## Motivation and Context
See #264
## How Has This Been Tested?
- Running locally and getting a token from `/v0/auth/none` and then
publishing to `/v0/publish`
- Updating the integration tests that get a token and then publish, and
them passing
## Breaking Changes
This is a breaking change to the auth API. This is fine for registry
given it's not deployed yet.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
The Always pull policy is needed for the latest tag to force Kubernetes
to pull the newest image on every pod creation, even if an image with
that tag already exists locally. Without this, pods might use outdated
cached versions since the latest tag is mutable and can point to
different images over time.
## Motivation and Context
- Enable all contributors to manage the infrastructure
- Enable deployments without error-prone manual intervention
## How Has This Been Tested?
Tested by deploying from this test branch, getting CI green and seeing
changes were applied
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
Adds the Pulumi code to:
- Deploy the registry (and associated services e.g. mongodb) to Google
Cloud Platform (GCP), on top of Google Kubernetes Engine (GKE)
- Sets up proper environments and secrets management
- Uses the real container image, now that it's published in #225. At the
moment attached to latest, we might want to pin the version later (or
perhaps always use `latest` in staging, and pin prod)
- Uses real domains (`staging.registry.modelcontextprotocol.io`) rather
than examples (``)
## Motivation and Context
Setting up infrastructure to deploy it. I set something up in Azure in
#227, although not super robust (e.g. no service accounts etc.). Think
we will use GCP as:
- the maintainers have experience with GCP, but none with Azure
- costs are quite low, and Anthropic is happy to cover them in the short
term
- means we only have to maintain one login system (just Google Cloud
Identity), not two (Google Workspace + Azure)
## How Has This Been Tested?
Deployed this to a staging and production cluster. Try it yourself at:
```bash
curl -H "Host: staging.registry.modelcontextprotocol.io" -k https://35.222.36.75/v0/ping
```
(will be sorting out domains very soon)
## Breaking Changes
NA - just adds support for GCP deployment
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Expected follow-ups:
- GitHub Action setup to deploy things to the cluster from GitHub, to
avoid gatekeeping to just the people with the secrets.
Original PR: #227
- Add Pulumi-based infrastructure as code for deploying MCP Registry to
Kubernetes
- Support for both local development (minikube) and Azure Kubernetes
Service (AKS)
- Complete deployment orchestration including:
- cluster setup: e.g. you point this at an Azure account, and it can set
up and manage the cluster for you. e.g. K8s version, number of nodes,
type of nodes, ...
- cloud agnostic K8s services: cert-manager, nginx-ingress
- app services: MongoDB, and registry application (currently using nginx
as a placeholder, blocked on #225 (as is #190). but should be a 1 line
change)
## How is this different to #190
- Supports cluster setup and management. This enables:
- Non-hosting maintainers managing many devops workflows (e.g. scaling
up the cluster, or bumping K8s versions). Without this, we'd need to
bug/page the organisation hosting the registry when we need these things
changed.
- Makes it easy to spin up things like staging/temporary clusters, as
well as enables contributors to replicate the stack exactly on their own
Azure accounts.
- Sets up cloud-agnostic services. For example, rather than using the
Azure-managed ingresses and CA, we install nginx-ingress and
cert-manager. This enables:
- Running the entire infra stack can also run locally (e.g. in minikube,
k3s, orbstack, colima) - making it much easier for contributors to test
changes to infra stuff.
- Moving between cloud providers much more easily, e.g. we could shift
from Azure to GCP/AWS/other with minimal hassle.
- Everything stays written in Go, rather than Helm templates. This means
we get things like type-checking etc. for free (which from my experience
makes AI tools wayyy better at editing K8s stuff), and contributors
don't need to learn a new language if they're already using Go.
## Testing
I've got this running well:
- locally in minikube
- on cloud in Azure (my personal Azure account)
<details><summary>Claude written architecture and security
review</summary>
<p>
## Deployment Review & Assessment
### Current Architecture Strengths
**Pulumi IaC Approach**
- Well-structured infrastructure as code using Pulumi
- Multi-provider support (AKS, local) with clean abstraction
- Good separation of concerns in `pkg/` directory
**Security Fundamentals**
- Non-root container execution (`appuser` with UID 10001)
- Secrets properly managed via Kubernetes secrets
- TLS/SSL certificate management with cert-manager and Let's Encrypt
### Critical Issues & High-Priority Improvements
**1. Production Deployment Not Ready** 🚨
The registry deployment uses `nginx:alpine` placeholder image instead of
the actual MCP registry:
- `deploy/pkg/k8s/registry.go:67` - TODO comments indicate incomplete
setup
- Health probes are commented out
- Port mapping doesn't match actual application (80 vs 8080)
**Fix:** Build and publish actual registry container image to GHCR,
update deployment
**2. Database Security Considerations** 🔒
- MongoDB deployed without authentication
- No backup/disaster recovery strategy
- Database credentials hardcoded
*Note: MongoDB is not exposed externally (ClusterIP service), so this is
not a critical security risk but should be addressed for production.*
**3. Monitoring & Observability Gaps** 📊
- No Prometheus/Grafana monitoring stack
- No log aggregation (ELK/Loki)
- No application metrics/health dashboards
- No alerting configured
**4. High Availability & Reliability** ⚠️
- Single MongoDB instance (no replication)
- No persistent volume backup strategy
- Fixed 10Gi storage without growth planning
- Only 2 replicas for registry service
- No pod disruption budgets
- No horizontal pod autoscaling
### Recommended Improvements
**Immediate (High Priority)**
1. Complete Registry Deployment - Build proper container image pipeline,
enable health checks
2. Secure MongoDB - Add authentication credentials, implement backup
strategy
**Medium Priority**
3. Add Monitoring Stack - Prometheus, Grafana deployment
4. Security Hardening (Nice to Have) - RBAC policies, Network Policies,
Pod Security Standards
5. CI/CD Pipeline Enhancement - Container image building/publishing,
automated deployment
**Lower Priority**
6. High Availability - MongoDB replica set, HPA for registry pods
7. Operational Excellence - Kubernetes dashboard, cost optimization
### Configuration Issues
- Production config has test credentials: `deploy/Pulumi.prod.yaml:4-5`
- Missing environment-specific resource sizing
- Hardcoded domain names (`example.com`)
The deployment setup shows good architectural foundations but needs
significant work before production readiness. The most critical issue is
the placeholder nginx container - priority should be completing the
actual registry application deployment before addressing the other
improvements. Security measures like RBAC and Network Policies are nice
to have but not strictly necessary given that MongoDB is not exposed
externally.
🤖 Generated with [Claude Code](https://claude.ai/code)
</p>
</details>
## Metadata
Working towards #91
---------
Co-authored-by: Claude <noreply@anthropic.com>
adam jones
dependabot[bot]
Radoslav Dimitrov
Preeti Dewani
Tadas Antanavicius
tadasant